Trust and security
Your teaching stays yours.
Drafts stay with your church until they are approved. Your teaching is used to serve your church, and is never used to train public models.
Trust
Review before members see anything.
Drafts are meant to be checked by staff before they become part of your church’s published voice. Members and public links never see drafts. A church can opt in to automatic approval for notes that pass checks; it is off by default.
- Answers and notes point back to the teaching they came from, so staff can check the claim
- When the church now teaches something differently, readers are pointed to the newer teaching
- Your church’s teaching belongs to your church, and is never used to train public models
The church now teaches this differently. Ask and notes point readers to the newer teaching.
A question in Ask on your website suggests someone may be in crisis. They were shown your crisis contacts, in your church’s words.
AOPastor Ade alerted. Owners next if nobody sees it.Nothing needs care right now. Pastor Ade’s note is saved in the alert’s private history.
Members and public links never see drafts. Automatic approval is optional and off by default.
Ask answers and notes point back to the teaching they came from, so staff can check the claim.
Quoted King James verses are checked before staff approve the note.
Mark teaching as replaced, outdated or withdrawn. Readers are told, and pointed to what the church teaches now.
If a question suggests someone is in crisis, Ask shows your church’s helplines and contacts, with a prompt to call local emergency services, and staff are alerted.
Owners invite staff and choose who can read, review, approve, or manage the church.
One church cannot see another church’s teaching, notes, questions, or members.
Your private teaching and drafts are used to serve your church, not to train public models.
The approval gate
Folio drafts notes and answers. A person at the church reviews them, checks the scripture, and approves them. Until that happens, the draft is visible only to staff and is never served to members, shared pages, email, the widget, or the public API.
A church can opt in to automatic approval for notes that pass guardrails, such as enough source material, checked scripture and no duplicate. It is off by default, an owner has to acknowledge it, and a note that fails a check goes back to a person. Approval is separate from publishing.
Every approved note keeps its version history. Improving the next draft never changes an approved version that members have already read.
Separation and access
Each church is its own space. Three things keep them apart:
- Every request is scoped to a single church, and every query carries that church’s identity.
- The database enforces the same rule, so a query that forgets the scope returns nothing rather than someone else’s teaching.
- A key or a member of staff sees only the scopes and permissions they were given, from read-only to owner.
A read-only key can read approved work and never sees a draft.
Training and ownership
Teachings, transcripts, notes, questions, team access, and usage belong to the church that added them. Private teaching and drafts are used to serve that church. They are never used to train public models.
If a church chooses to publish something, it is governed by that church’s own sharing settings, not by us.
How data is protected
- Connections are encrypted with TLS. Sensitive fields, such as care alert text, saved Ask facts, connected-source credentials, authenticator secrets and webhook secrets, are encrypted before they are stored, and backups are encrypted.
- Passwords, API keys and recovery codes are stored hashed. Secrets are redacted from logs.
- Logs carry a request identifier, the path and the status, are kept 14 days, and are not meant to carry personal data.
- Folio staff have no standing access to a church’s content. An owner can grant support access that is limited in scope and expires, and every request made under it is recorded.
- Media and transcripts are stored in object storage with per-church paths, on servers in Germany.
Retention, export and deletion
A church sets how long recordings, captions, Ask conversations, care alerts and audience events are kept, or keeps them until it removes them. An owner can export the church’s data as an archive, and can schedule the church’s deletion. Deletion begins after a 14-day grace period, and can be cancelled until it starts. Deleted data remains in encrypted backups until they roll off, up to about 12 months.
Report a vulnerability
If you find a security problem, write to [SECURITY CONTACT EMAIL] with what you found and how to reproduce it. We will acknowledge it within [ACKNOWLEDGEMENT TIME], keep you informed, and fix confirmed issues based on risk.
- Test only your own account or a sandbox church. Do not read, change or delete other churches’ data, and stop and tell us if you reach it by accident.
- Do not degrade the service, run denial of service or volume tests, social-engineer staff, or use physical access.
- Give us reasonable time to fix the issue before you tell anyone else.
- We will not take legal action against research that follows these rules and is in good faith. We do not run a paid bounty programme at present.
Report a concern
If you believe you have found a security issue, or you want to talk through how your church’s data is handled, write to [email protected]. We would rather hear from you early.